What Is Lateral Movement?

Lateral movement is the process attackers use to move from one compromised system to other systems inside the same environment. After gaining an initial foothold, they use lateral movement to expand access, reach higher-value assets, compromise additional accounts, and work toward goals such as ransomware deployment, data theft, or broader operational control.

It is a key phase of many serious intrusions because the first compromised host is often just the starting point. For related background, see what is privilege escalation and what is ransomware.

How lateral movement works

Lateral movement usually begins after the attacker already has access to at least one system.

The attacker gains an initial foothold

The first compromised host may come from:

• Phishing or malware execution
• A stolen password
• An exposed remote access service
• Exploitation of a vulnerable application
• Abuse of a trusted vendor or partner connection

At this point, the attacker often has limited privileges and only partial visibility. The next step is to learn the environment and find better access.

The attacker performs internal discovery

Once inside, attackers usually map the environment to identify:

• Reachable hosts
• Logged-in users
• Shared drives and file servers
• Backup systems
• Identity infrastructure
• Administrative tools and services
• Business-critical applications

This can involve looking at hostnames, shares, directory relationships, remote management protocols, and cloud-connected services. The goal is to find the shortest path to more valuable systems.

The attacker gathers credentials or tokens

Lateral movement often depends on valid credentials. Attackers may obtain them through:

• Password reuse
• Browser-stored passwords
• Cached credentials
• Session tokens
• Credential dumping
• Service account abuse
• Local admin passwords reused across systems

This is one reason lateral movement can be hard to detect. Instead of exploiting every new system directly, attackers often log in using real accounts.

The attacker pivots to other systems

With credentials or access paths in hand, the attacker moves to additional hosts using tools and protocols already trusted in the environment.

Common methods include:

• Remote Desktop Protocol
• Administrative shares
• Remote shell access
• PowerShell remoting
• SSH
• Centralized management tools
• Scheduled tasks
• Service creation
• VPN or jump host access

Because these are often legitimate administrative mechanisms, the activity may blend into normal IT operations.

The attacker seeks broader reach and higher privilege

As the attacker moves, they usually aim for one or more high-value targets:

• Domain or identity administration
• Email systems
• File servers
• Backups
• Financial systems
• HR or payroll platforms
• Cloud administration
• Security tooling

This stage often overlaps with privilege escalation. Lateral movement is movement across systems; privilege escalation is gaining more authority. In real incidents, they often happen together.

The attacker stages the final objective

Once the attacker reaches the right systems and accounts, lateral movement supports the end goal, such as:

• Deploying ransomware widely
• Exfiltrating sensitive data
• Disabling security tools
• Establishing persistence on multiple systems
• Expanding into cloud or SaaS environments
• Disrupting business operations

From an incident response perspective, this is the phase where a small breach can become organization-wide.

Common examples of lateral movement

Lateral movement can look different depending on the environment and attacker goals.

User workstation to file server

An attacker compromises one employee laptop, steals credentials, and accesses shared drives that hold sensitive internal documents.

Workstation to domain controller

A local admin password or cached credential is abused to move from a user device toward identity infrastructure.

Mailbox compromise to internal systems

A compromised email account is used to reset passwords, access shared resources, or socially engineer other employees for additional access.

Hybrid environment pivot

An attacker moves from an on-premises foothold into synchronized identity systems, then reaches cloud workloads or SaaS administration.

When you are likely to encounter lateral movement

You will most often hear about lateral movement during incident response, threat hunting, and security architecture discussions.

Common scenarios include:

• Ransomware investigations: Attackers move across the network before encryption to maximize impact.
• Threat hunting: Analysts look for unusual internal remote access, credential abuse, or system-to-system pivots.
• Active Directory reviews: Teams assess how an attacker moved from a user endpoint toward privileged systems.
• Cloud-hybrid incidents: A compromise spreads from endpoint to identity layer to cloud management.
• Security design reviews: Organizations test whether segmentation and identity controls can slow or stop internal pivoting.

Small and midsize businesses face the same problem even if they do not use the term formally. In a flatter environment, one compromised account can sometimes reach shared drives, backups, business apps, and admin systems with very little resistance.

Why lateral movement matters

The initial compromise is not always what causes the largest loss. The damage often comes later, when the attacker uses one foothold to reach everything that matters.

That is why lateral movement is so important in:

• Ransomware defense
• Incident containment
• Identity security
• Network segmentation
• Endpoint monitoring
• Privileged access management

If defenders can detect and interrupt lateral movement early, they can often stop a single compromised system from becoming a company-wide incident.

How to reduce lateral movement risk

Stopping every initial compromise is unrealistic, so defenses should also limit what an attacker can do after getting in.

Strengthen identity controls

Useful controls include:

• MFA on remote and privileged access
• Unique local admin credentials
• Least-privilege access
• Privileged access separation
• Rapid removal of stale accounts
• Password managers such as Try 1Password → to reduce weak or reused passwords

Improve endpoint visibility

You need visibility into suspicious process execution, remote administration activity, and credential abuse. That is where endpoint protection and EDR matter. For smaller teams, anti-malware tools like Get Malwarebytes → can help improve baseline device protection.

Segment the network

Network segmentation reduces how freely attackers can move. Sensitive systems should not be broadly reachable from ordinary user devices.

Monitor for unusual internal behavior

Look for signs such as:

• Remote access between systems that do not normally communicate
• Logins from unusual hosts
• Use of admin tools outside expected patterns
• Sudden access to backups or identity systems
• Service creation or scheduled tasks on many hosts

Lateral movement vs related terms

Initial access

Initial access is the first point of compromise. Lateral movement happens after that foothold is established.

Privilege escalation

Privilege escalation means gaining higher permissions. It often enables or accelerates lateral movement.

Credential dumping

Credential dumping is the theft of passwords, hashes, or tokens from a compromised host. Those credentials are commonly used to move laterally.

Persistence

Persistence is the ability to maintain access over time. Attackers may establish persistence on multiple systems as they move through the environment.

Network segmentation

Network segmentation limits which systems can communicate. It is one of the most effective ways to slow lateral movement.

Final takeaway

Lateral movement is the phase of an intrusion where an attacker moves from one compromised system to others to expand access, find valuable assets, and deepen control. It is a major reason why a single phishing click, stolen password, or exposed service can turn into a much larger security incident.

The practical security question is not just how to prevent initial access, but how to stop attackers from moving once they get in. Strong identity controls, endpoint visibility, and network segmentation are what make that possible.